Suricata suddenly stops and cannot be started

Security Intrusion Prevention
1

After 4 days of operation, suricata suddenly stops and cannot be started again

18:10:41 suricata: This is Suricata version 4.1.6 RELEASE
18:10:41 suricata: [ERRCODE: SC_ERR_INITIALIZATION(45)] - pid file ‘/var/run/suricata.pid’ exists b ut appears stale. Make sure Suricata is not running and then remove /var/run/sur icata.pid. Aborting!
18:15:33 suricata: This is Suricata version 4.1.6 RELEASE
18:15:33 suricata: [ERRCODE: SC_ERR_INITIALIZATION(45)] - pid file ‘/var/run/suricata.pid’ exists b ut appears stale. Make sure Suricata is not running and then remove /var/run/sur icata.pid. Aborting!
18:16:03 suricata: This is Suricata version 4.1.6 RELEASE
18:16:03 suricata: [ERRCODE: SC_WARN_NO_STATS_LOGGERS(261)] - stats are enabled but no loggers are active
18:16:03 suricata: [ERRCODE: SC_ERR_NFQ_CREATE_QUEUE(72)] - nfq_create_queue failed
18:16:03 suricata: [ERRCODE: SC_ERR_NFQ_THREAD_INIT(78)] - nfq thread failed to initialize
18:19:28 suricata: This is Suricata version 4.1.6 RELEASE
2

Hi,
have had the same a couple of days ago but am not sure what happens there. I stopped Suricata via WUI and deleted /var/run/suricata.pid via
rm /var/run/suricata.pid
enabled it again via WUI and restarted IPFire. Since then it works but there seems to be a problem somewhere, not sure if it happens while an update…

Best,

Erik

1 Like
3

Ditto for me. I had the same experience. Removing the pid file seems to have cleared up the issue

4

I run also into this. suricata refuses to stop and the pidfile was locked. I have added a
killall -KILL /usr/bin/suricata
after the chain flush.

https://git.ipfire.org/?p=ipfire-2.x.git;a=commitdiff;h=57fda8c8adc66acf92c24d33ccf37636e0e165bc

1 Like
5

I have got this now on testing/146 but figured this is not related to 146. The last messages in the logs before the error messages appearing (when trying to start service) are all for same reasons but for different signatures:

rule reload complete
:
ERRCODE: SC_ERR_INVALID_SIGNATURE(39) .... ]
:
rule reload starting

I was using the snort/community rules.

Using emerging threats community rules works e.g. does not crash suricata.